CVE-2025-11701

MediumCVSS 5.3/10Last modified Oct 8, 2026

Description

The Zip Attachments plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check as well as missing post status validation in the za_create_zip_callback function in all versions up to, and including, 1.6. This makes it possible for unauthenticated attackers to download attachments from private and password-protected posts.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-862

Affected software

No affected versions have been published.

Timeline

Published: Oct 15, 2025
Last modified: Oct 8, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-117028.8GitLab has remediated an issue in EE affecting all versions from 17.1 before 18.3.5, 18.4 before 18.4.3, and 18.5 before 18.5.1 that could h CVE-2025-117035.3The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to Cache Poisoning in all versions up to, and including, 9.0.48.CVE-2025-117047.5The Elegance Menu plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.9 via the 'elegance-men CVE-2025-117056.5The Anti-Malware Security and Brute-Force Firewall plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and incl CVE-2025-117066.1The Aruba HiSpeed Cache plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the dbstatus parameter in all versions up t CVE-2025-117075.3The Login Lockdown & Protection plugin for WordPress is vulnerable to IP Block Bypass in all versions up to, and including, 2.14. This is du CVE-2025-117089.8Use-after-free in MediaTrackGraphImpl::GetInstance(). This vulnerability was fixed in Firefox 144, Firefox ESR 140.4, Thunderbird 144, and T CVE-2025-117099.8A compromised web process was able to trigger out of bounds reads and writes in a more privileged process using manipulated WebGL textures. CVE-2025-11716.1A vulnerability classified as problematic was found in code-projects Real Estate Property Management System 1.0. Affected by this vulnerabil CVE-2025-117109.8A compromised web process using malicious IPC messages could have caused the privileged browser process to reveal blocks of its memory to th CVE-2025-117116.5There was a way to change the value of JavaScript Object properties that were supposed to be non-writeable. This vulnerability was fixed in CVE-2025-117126.1A malicious page could have used the type attribute of an OBJECT tag to override the default browser behavior when encountering a web resour